ai-dial-chat: Skill for Claude Code

Dependency Scan (Trivy)

Overview

Filesystem scan for known CVEs. Trivy autodetects lockfiles (package-lock.json, pnpm-lock.yaml, etc.) and produces a JSON report; this skill parses that report and emits findings in the SDLC reviewer shape so downstream agents (e.g., /dep-triage) and human reviewers can consume them uniformly.

This is the scan step only — no triage, no false-positive analysis. That happens downstream.

When to use

• PR-time dependency check (chained before /dep-triage).
• Scheduled dependency scans (nightly, weekly).
• Any flow needing machine-readable vulnerability output that another agent or process will consume.

Required tools

• Bash(trivy:*) — to invoke the CLI
• Write — to produce stage-output.json (auto-granted by the platform)
• Read, Glob — to inspect lockfiles or scan output if needed

Process

1. Run Trivy

Filesystem scan from repo root, JSON output, medium severity and above. Use Trivy's --output flag, not shell redirection (>) — Claude Code's Bash tool rejects shell-redirection operators and would deny the command:

trivy fs --format json --severity HIGH,CRITICAL,MEDIUM --quiet --output /tmp/trivy.json .

Same effect: writes report to /tmp/trivy.json. No >, no |, no shell-variable expansion — exactly what Bash(trivy:*) allows.

Notes:

• --quiet suppresses interactive UI noise.
• If /tmp/trivy.json is missing or zero-length after the command, treat it as a scanner failure (see Heuristics).

2. Parse the report

Use the Read tool to load /tmp/trivy.json into your reasoning context. Do NOT attempt to use cat, head, tail, jq, grep, awk, or any other shell command to inspect the file — those aren't in the agent's allowed_tools (only Bash(trivy:*) is) and the Bash tool will deny them, burning turns on retries. The Read tool is the intended path for inspecting on-disk JSON.

The file is on the order of tens-to-hundreds of KB; one Read call loads it cleanly.